Auditors are required by Generally Accepted Government Auditing Standards (GAGAS) to develop sufficient, competent, evidential matter to support their conclusions and recommendations. Requests for such data, records, and information must be relevant to the audit being performed. There is no basis in any regulations, statute, or contract provision that authorizes auditors access to records beyond what is necessary to perform the audit.
If it is not intuitively obvious to contractors why certain requested data is relevant to the audit being performed, contractors should inquire as to the purpose or the intended use of the data. Auditors are required to be prepared to answer such questions. If the auditor cannot do so to the contractors' satisfaction, denying access may be appropriate. Of course, from an auditor's perspective, denials tend to be met with suspicions that the contractor may be hiding something. Therefore, while denial might be appropriate, it may not be advisable.
Once denial is alleged by the Government, the issue is raised to higher and higher levels within the contractors' and governmental organizations. At some point, the issue is resolved or the Government seeks a subpoena. In practice however, these issues are generally resolved at low levels. Common sense usually prevails is such matters. However, the Government has published guidelines on conditions that qualify as access to records problems. These include:
- Contractor refusal to provide access to any requested record including support for unclaimed costs excluded under CAS 405 or records maintained in an electronic or optical format.
- Unreasonable delays by contractor representatives in permitting the audit commencement or in providing access to needed data or personnel.
- Restrictions on reproduction of necessary supporting evidential matter.
- Partial or complete denial of access to internal audit data or other management reports on contractor operations.
- Denial of access to the contractor's data base.
- Chronic failure of contractor personnel to comply with agreed-to dates for furnishing data.
- Assertion of attorney-client privilege or attorney work product rule. The auditor is not in a position to accept a claim of attorney-client privilege or the work product rule. Therefore, auditors are instructed to obtain a legal opinion from counsel when a claim of privilege is made.